如何在KQL中将当前磁盘空间与前几天的磁盘空间进行比较

Question

我有一个查询，显示可用磁盘空间最少的服务器，但我想添加一列，显示与历史数据相比的空间(以捕捉任何突然减少的情况(

我似乎只能让它在的几次事件中工作

到目前为止我的代码

let start = ago(24h); 
let End_date = ago(48h); 
let Curr =Perf
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" 
| where TimeGenerated >ago(1h)
|extend dim =strcat(Computer,InstanceName)
|summarize CurrentVal= max(CounterValue) by Computer,InstanceName;
let Prev = Perf 
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space" 
| where TimeGenerated >End_date 
|where TimeGenerated <start
|extend dim =strcat(Computer,InstanceName)
|summarize YesterdayVal=max(CounterValue) by Computer,InstanceName;
Curr 
|join kind = leftouter Prev on InstanceName and Computer
//|extend diff = CurrentVal - YesterdayVal
//|extend Diskspace =CurrentVal 
//|project Computer, InstanceName, Diskspace, diff

Answer 1

一个可能的解决方案：

let start = ago(24h); 
let End_date = ago(48h); 
Perf
| where TimeGenerated > End_date
| where ObjectName == "LogicalDisk" and CounterName == "% Free Space"
| extend Current= TimeGenerated > start
| summarize
Diskspace= maxif(CounterValue, Current),
Diff= maxif(CounterValue, Current) - maxif(CounterValue, not(Current))
by Computer, InstanceName